[FR] Additional Unit Test For Placeholder Fields

[eric-forte-elastic]

Summary

The investigation guides now leverage a new OSQuery variable feature to autofill from data within detection rule alert (e.g. {{file.name}}). We should add a unit test that checks for this note on investigation guires that use these placeholder fields.

Note:

• This investigation guide uses placeholder fields to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.

References

• Similar to this test
• Investigation guide feature

[botelastic[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[botelastic[bot]]

This has been closed due to inactivity. If you feel this is an error, please re-open and include a justifying comment.

[brokensound77]

Can you elaborate on the things you want to test specifically

[w0rk3r]

This one is like the version disclaimer we do with Osquery:

> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.

But for Osquery placeholder fields (https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html), which is an 8.7+ feature